1 00:00:00,369 --> 00:00:04,269 You found the backup wrap up your go-to podcast for all things 2 00:00:04,269 --> 00:00:06,849 backup recovery and cyber recovery. 3 00:00:07,299 --> 00:00:10,119 In this episode, we take a look at reconnaissance in 4 00:00:10,119 --> 00:00:14,769 Cybersecurity by examining Mr. Robot season one, episode two. 5 00:00:15,369 --> 00:00:19,299 Persona and I break down how threat actors conduct reconnaissance 6 00:00:19,539 --> 00:00:20,859 before launching major attacks. 7 00:00:21,799 --> 00:00:26,299 Just like F Society did against Evil Corp. In the show, we explore the 8 00:00:26,299 --> 00:00:31,099 human intelligence aspects, you know, like figuring out who's dumb enough to 9 00:00:31,099 --> 00:00:36,529 take a random CD from some guy on the street and put it in their computer. 10 00:00:37,069 --> 00:00:40,819 We also discuss why your backup systems are prime targets for recon. 11 00:00:41,419 --> 00:00:46,249 Modern attackers can spend months mapping your infrastructure, identifying your 12 00:00:46,249 --> 00:00:48,134 weaknesses, and planning their approach. 13 00:00:48,609 --> 00:00:52,479 This episode will, I think, open your eyes to just how thorough 14 00:00:52,779 --> 00:00:54,819 those recon operations can be. 15 00:00:55,569 --> 00:01:00,159 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. Backup, 16 00:01:00,249 --> 00:01:05,139 and I've been passionate about backup and recovery for over 30 years, ever since. 17 00:01:05,139 --> 00:01:08,409 I had to tell my boss that we had no backups of the production 18 00:01:08,409 --> 00:01:09,574 database that we had just lost. 19 00:01:10,374 --> 00:01:13,434 I don't want that to happen to you, and that's why I do this. 20 00:01:13,854 --> 00:01:18,804 On this podcast, we turn unappreciated admins into Cyber Recovery Heroes. 21 00:01:19,134 --> 00:01:21,144 This is the backup wrap up. 22 00:01:37,478 --> 00:01:38,408 Welcome to the show. 23 00:01:39,008 --> 00:01:42,068 Hi, I am w Curtis Preston, AKA, Mr. Backup. 24 00:01:42,068 --> 00:01:45,968 And I have with me a guy that just doesn't seem to get stressed out like I do. 25 00:01:46,348 --> 00:01:48,498 Prasanna Malaiyandi. 26 00:01:48,498 --> 00:01:50,058 How's it going, Prasanna. 27 00:01:50,133 --> 00:01:50,953 I'm good, Curtis. 28 00:01:51,853 --> 00:01:52,678 How do you stay? 29 00:01:52,678 --> 00:01:56,128 So like even keel, like you're just like, I'm just like, ah. 30 00:01:56,128 --> 00:01:58,378 And you're just like, you're good, man. 31 00:01:58,453 --> 00:01:59,069 yeah, you just. 32 00:01:59,773 --> 00:02:03,673 I honestly, I don't think I used to be like this. 33 00:02:05,458 --> 00:02:05,908 Is it? 34 00:02:06,838 --> 00:02:07,978 Is it, is it weed? 35 00:02:07,983 --> 00:02:08,273 What? 36 00:02:08,503 --> 00:02:10,783 No, no. 37 00:02:10,783 --> 00:02:14,833 Like up or even after that, like through high school and college. 38 00:02:14,833 --> 00:02:17,713 I even like the beginning part of my career, I don't think I 39 00:02:17,713 --> 00:02:19,033 was like even keeled like this. 40 00:02:19,033 --> 00:02:22,483 I, for the most part I was, but I used to get stressed and 41 00:02:22,483 --> 00:02:23,443 then I don't know what changed. 42 00:02:23,443 --> 00:02:24,673 Something clicked and 43 00:02:24,853 --> 00:02:24,933 Hmm. 44 00:02:25,033 --> 00:02:25,573 I am like, okay. 45 00:02:26,608 --> 00:02:26,998 Hmm. 46 00:02:27,433 --> 00:02:27,793 I know a 47 00:02:27,838 --> 00:02:28,768 You're like, um, 48 00:02:28,783 --> 00:02:31,513 who are like, how are you so calm all the time? 49 00:02:31,513 --> 00:02:32,833 It'd be like in the middle of a fire drill. 50 00:02:32,833 --> 00:02:33,973 I'm like, uh, it's okay. 51 00:02:34,378 --> 00:02:37,018 yeah, I need, I need you in my fire drills. 52 00:02:37,138 --> 00:02:40,378 Um, I feel like I'm in the middle of like three or four fire drills, like right now. 53 00:02:40,408 --> 00:02:43,768 Like you saw, I got three phone calls we're trying to do, we're trying 54 00:02:43,768 --> 00:02:47,158 to do this episode and I got like three phone calls, which reminds 55 00:02:47,158 --> 00:02:51,448 me, I'm gonna put, I'm gonna put my phone on, you know, focus right. 56 00:02:52,228 --> 00:02:53,758 Um, there. 57 00:02:53,788 --> 00:02:54,298 Okay. 58 00:02:55,498 --> 00:02:57,808 Um, so. 59 00:02:57,973 --> 00:02:59,563 Curtis, just take a deep breath. 60 00:03:00,373 --> 00:03:03,403 Shall we turn this into like a meditation? 61 00:03:03,538 --> 00:03:03,868 Yeah. 62 00:03:05,108 --> 00:03:11,288 Anyway, but uh, speaking of focusing on stuff, uh, we are continuing our 63 00:03:11,288 --> 00:03:13,598 series of lessons learned from Mr. 64 00:03:13,598 --> 00:03:15,008 Robot, which is a great show. 65 00:03:16,153 --> 00:03:17,563 Spoiler alert, by the way. 66 00:03:17,623 --> 00:03:20,263 Uh, we're gonna be talking about stuff in this episode, 67 00:03:20,563 --> 00:03:22,003 uh, and all of these episodes. 68 00:03:22,003 --> 00:03:25,243 If you haven't watched it, if you haven't watched episode, season one, 69 00:03:25,243 --> 00:03:29,023 episode two of Mr. Robot, go watch it now before you listen to the podcast. 70 00:03:29,563 --> 00:03:32,743 When you and I watched this episode, we, we weren't quite sure what we 71 00:03:32,743 --> 00:03:34,183 were gonna pull outta this episode. 72 00:03:34,183 --> 00:03:35,143 And, um. 73 00:03:35,983 --> 00:03:37,813 There, there's a couple of things. 74 00:03:38,173 --> 00:03:40,693 This is a very foundational episode. 75 00:03:40,693 --> 00:03:42,613 You know, we sort of learn who Mr. Robot is. 76 00:03:42,613 --> 00:03:47,503 We learn, um, that, that, um, and, and Elliot is given the, the 77 00:03:47,503 --> 00:03:51,043 opportunity to participate in this hack that they want to take down. 78 00:03:51,253 --> 00:03:52,843 Uh, evil Corp, which I love. 79 00:03:52,843 --> 00:03:53,653 I love that. 80 00:03:53,653 --> 00:03:58,963 It's called Evil Corp. And uh, and it uses essentially Enron's logo. 81 00:03:59,698 --> 00:04:05,818 Completely unmodified, which is onic, you know, to say the least. 82 00:04:05,848 --> 00:04:11,278 And then, um, you know, he's given the opportunity to participate in this thing. 83 00:04:11,278 --> 00:04:14,098 And then they basically said, look, if you walk away, you walk away. 84 00:04:14,098 --> 00:04:17,098 And, um, you know, and, and he does, he actually walks away. 85 00:04:17,458 --> 00:04:19,828 Um, he, he will obviously end up coming back. 86 00:04:19,828 --> 00:04:21,658 Otherwise this would be a very short series. 87 00:04:21,658 --> 00:04:23,368 But, um. 88 00:04:23,608 --> 00:04:23,698 end. 89 00:04:23,998 --> 00:04:24,868 The The end. 90 00:04:24,868 --> 00:04:25,318 Yeah. 91 00:04:25,708 --> 00:04:30,688 But what we're gonna focus on is this concept of reconnaissance and network 92 00:04:30,688 --> 00:04:37,198 mapping, because what you see is that clearly they have been doing that because 93 00:04:37,228 --> 00:04:39,868 they know some things about Evil Corp 94 00:04:40,558 --> 00:04:41,908 that they wouldn't know otherwise. 95 00:04:42,313 --> 00:04:46,483 And so maybe just to provide a bit more context, because I'm sure people are 96 00:04:46,483 --> 00:04:49,603 not watching it as recently as we have. 97 00:04:49,873 --> 00:04:52,663 So in this episode, kind of as a recap, right? 98 00:04:52,663 --> 00:04:57,673 What ends up happening is he goes and he visits the bunker with where F Society is. 99 00:04:58,073 --> 00:04:58,553 Right. 100 00:04:58,613 --> 00:05:04,913 Um, in addition, this is where Mr. Robot tells him, Hey, we want you 101 00:05:04,973 --> 00:05:08,333 to, and we will discuss more in details about the network mapping. 102 00:05:08,633 --> 00:05:12,503 We want you to take out their backup facility where, if you don't remember, 103 00:05:12,503 --> 00:05:14,003 it was called Steel Mountain. 104 00:05:14,053 --> 00:05:19,003 Steel Mountain, not to be confused with any other company by a similar name. 105 00:05:19,393 --> 00:05:19,873 Yes. 106 00:05:19,933 --> 00:05:24,343 And it just, and that's where they have their backups as well as there just 107 00:05:24,343 --> 00:05:26,893 happens to be a gas plant next to it. 108 00:05:26,893 --> 00:05:27,973 We will talk about that 109 00:05:28,213 --> 00:05:28,603 Right. 110 00:05:28,753 --> 00:05:29,203 bit. 111 00:05:29,473 --> 00:05:35,933 Um, in addition, in this episode, this is also where you meet the drug dealer, uh, 112 00:05:36,448 --> 00:05:36,738 Yeah. 113 00:05:37,388 --> 00:05:38,618 right where, uh. 114 00:05:39,643 --> 00:05:44,503 Elliot's neighbor Shayla gets the drugs that she then sells to Elliot. 115 00:05:44,923 --> 00:05:47,953 Uh, so Fernando Vera was the guy's name. 116 00:05:48,253 --> 00:05:50,233 Um, let's see what else happened in this episode. 117 00:05:50,233 --> 00:05:56,193 This is also the episode where, um, I don't know if people remember it, but um. 118 00:05:57,253 --> 00:05:59,403 Angela And Ollie, right? 119 00:05:59,403 --> 00:06:00,298 Her boyfriend. 120 00:06:00,618 --> 00:06:00,908 Yeah. 121 00:06:01,078 --> 00:06:05,428 kind of standing out on the street and there is a guy who's trying to sell CDs. 122 00:06:05,818 --> 00:06:06,108 Yeah. 123 00:06:06,178 --> 00:06:08,938 like, oh, sell my CD or Buy my cd. 124 00:06:08,938 --> 00:06:11,728 All I need is like 20 tweets saying 125 00:06:11,743 --> 00:06:12,163 Yeah. 126 00:06:12,178 --> 00:06:12,928 it or whatever else. 127 00:06:12,958 --> 00:06:13,408 Yeah. 128 00:06:13,438 --> 00:06:13,948 Yeah. 129 00:06:14,428 --> 00:06:18,478 And they gave, and they gave him a cd, which turns out to be, uh, something very 130 00:06:18,478 --> 00:06:21,628 much not a CD or not a, not a music cd. 131 00:06:21,973 --> 00:06:22,333 Yeah, 132 00:06:22,583 --> 00:06:22,873 Yeah, 133 00:06:22,993 --> 00:06:26,143 in this episode too, right, they talk about how Ollie 134 00:06:26,143 --> 00:06:28,543 puts it in the laptop at home, 135 00:06:28,793 --> 00:06:29,083 yeah, 136 00:06:29,413 --> 00:06:34,303 And the guy is able to sort of take over it, installs some malware. 137 00:06:34,303 --> 00:06:34,543 He's 138 00:06:34,643 --> 00:06:34,933 yeah, 139 00:06:35,113 --> 00:06:36,853 at the webcam right 140 00:06:36,958 --> 00:06:37,318 yeah. 141 00:06:37,318 --> 00:06:37,319 Yeah. 142 00:06:38,083 --> 00:06:38,863 all the rest of that, 143 00:06:39,088 --> 00:06:43,258 And that was, that was where the very, the very last moment of that episode is 144 00:06:43,258 --> 00:06:49,578 when he's seeing the webcam and he can see the girl, uh, he can see Angela basically 145 00:06:49,578 --> 00:06:52,068 like going to take, I think take a shower. 146 00:06:52,068 --> 00:06:53,208 And he's like, we're in. 147 00:06:53,238 --> 00:06:56,448 The last line in the episode is we're in and 148 00:06:56,573 --> 00:06:56,993 And 149 00:06:57,203 --> 00:06:57,533 "we're 150 00:06:57,533 --> 00:06:59,303 in", was actually written in Chinese. 151 00:06:59,783 --> 00:07:00,473 Oh, okay. 152 00:07:00,503 --> 00:07:00,953 Okay. 153 00:07:01,043 --> 00:07:02,093 I guess I missed that part. 154 00:07:02,168 --> 00:07:02,458 Yeah. 155 00:07:03,173 --> 00:07:13,913 Um, the, and so any crucial, any hack, any major hack, which is going to 156 00:07:13,913 --> 00:07:19,163 include, like, this is, this is, you know, this hack that they want to do of. 157 00:07:19,673 --> 00:07:26,933 Evil Corp I is, is definitely, I would, I would call this like a, an EPT an or an 158 00:07:26,933 --> 00:07:29,393 a PT, an adv advanced persistent threat. 159 00:07:29,393 --> 00:07:29,633 Right? 160 00:07:29,633 --> 00:07:33,533 You know, they've got, they're going to be doing this over a long run, a 161 00:07:33,533 --> 00:07:37,973 long period of time, and they have a goal in mind and they, and they 162 00:07:37,973 --> 00:07:43,614 are willing to be patient to, um, to do the things that they need to do. 163 00:07:44,153 --> 00:07:45,383 To, to move forward. 164 00:07:45,413 --> 00:07:50,303 And I, I, I think that it, it gives us an opportunity to discuss this 165 00:07:50,303 --> 00:07:55,073 concept of reconnaissance, um, and, and network mapping, which is what 166 00:07:55,073 --> 00:07:55,973 we're, what we're talking about. 167 00:07:56,108 --> 00:07:57,248 Their goal, right? 168 00:07:57,368 --> 00:07:58,598 With this entire thing, right? 169 00:07:58,598 --> 00:08:01,238 What are they looking to accomplish with Evil Corp, right? 170 00:08:01,508 --> 00:08:05,943 Evil Corp basically has all the credit records of everyone in the country. 171 00:08:06,908 --> 00:08:07,258 Right, 172 00:08:08,228 --> 00:08:12,098 as you start to see Angela's in heavy debt with student loans, right? 173 00:08:12,098 --> 00:08:17,048 There are other people who, uh, Shayla, the Elliot's neighbor is also in debt, 174 00:08:17,438 --> 00:08:22,808 and so it's basically they're like, we can basically attack the company, 175 00:08:22,808 --> 00:08:28,688 destroy everything, and do basically a giant reset on everyone's rec financial 176 00:08:28,913 --> 00:08:28,914 right. 177 00:08:29,603 --> 00:08:29,933 Right. 178 00:08:30,578 --> 00:08:30,788 and 179 00:08:30,863 --> 00:08:31,133 Yeah. 180 00:08:31,163 --> 00:08:33,593 So that's, that's their end goal, right? 181 00:08:33,683 --> 00:08:39,023 Um, basically, you know, deleting and, and, and they know that if they delete 182 00:08:39,023 --> 00:08:45,563 the, the primary copy, they know that, uh, they have, um, a copy, you know, in 183 00:08:45,563 --> 00:08:48,173 their backups stored in Steel Mountain. 184 00:08:48,468 --> 00:08:48,758 Yeah. 185 00:08:49,793 --> 00:08:52,673 and so they know therefore, and by the way, why. 186 00:08:53,333 --> 00:08:55,013 And I guess, how do they know that? 187 00:08:55,013 --> 00:08:58,103 And the answer, the, the answer to that question is, the answer to this 188 00:08:58,133 --> 00:09:00,473 or the to is the title of this episode. 189 00:09:01,013 --> 00:09:06,053 Because they went in and they did reconnaissance and they figured out, and, 190 00:09:06,053 --> 00:09:09,413 and again, this is something that we, we've said on multiple episodes that. 191 00:09:10,643 --> 00:09:16,823 It's going to be one of the primary goals of once, once the initial, um, 192 00:09:16,883 --> 00:09:22,493 access has been granted to the threat actor, their next step is going to be 193 00:09:22,523 --> 00:09:27,233 figure out what can we get rid of that, you know, that basically how can we stop 194 00:09:27,293 --> 00:09:29,993 whatever it is that would then stop us? 195 00:09:29,993 --> 00:09:30,743 In other words, 196 00:09:31,283 --> 00:09:32,903 they're gonna try to take out the backups. 197 00:09:32,963 --> 00:09:33,383 Right. 198 00:09:33,443 --> 00:09:35,153 And you know, and, and, and yeah. 199 00:09:35,153 --> 00:09:38,843 This is a podcast dedicated to backups, but. 200 00:09:39,133 --> 00:09:41,863 And so maybe, you know, to hammer everything looks like a nail. 201 00:09:41,923 --> 00:09:42,643 Trust me. 202 00:09:42,973 --> 00:09:46,903 Talk to any, you know, go listen to the Red Team Epi episode where he 203 00:09:46,903 --> 00:09:48,463 basically said, he said two things. 204 00:09:48,463 --> 00:09:52,003 One is he loved backups because they were so great at helping him to do 205 00:09:52,003 --> 00:09:53,863 network mapping and figure things out. 206 00:09:54,283 --> 00:09:57,013 And, uh, and he loved the system, the fact that they run 207 00:09:57,013 --> 00:09:58,333 his system and all that stuff. 208 00:09:58,633 --> 00:10:01,663 Uh, and then the other is, yes, you're gonna try to take that out. 209 00:10:02,083 --> 00:10:05,503 And unfortunately, many of the designs that we have today are 210 00:10:05,503 --> 00:10:07,663 using entirely disc based backups. 211 00:10:07,933 --> 00:10:14,773 Dis and cloud, uh, and if you're, depending on how you set that up, they 212 00:10:14,773 --> 00:10:20,083 can easily map all of that stuff, figure that stuff out, and then delete it. 213 00:10:20,413 --> 00:10:20,863 Right. 214 00:10:21,343 --> 00:10:27,823 And what we have in this episode is we do see that this company is at least storing 215 00:10:27,823 --> 00:10:31,933 some offsite backups in Steel Mountain. 216 00:10:32,383 --> 00:10:35,383 And um, in this case it happens to be tape backups. 217 00:10:35,383 --> 00:10:36,913 It doesn't have to be tape backups, right. 218 00:10:36,913 --> 00:10:37,513 But yeah. 219 00:10:37,778 --> 00:10:38,213 which, which 220 00:10:38,243 --> 00:10:38,543 Go ahead. 221 00:10:38,603 --> 00:10:40,943 basically a third party vendor, right? 222 00:10:40,943 --> 00:10:41,153 It's 223 00:10:41,243 --> 00:10:43,073 It's a third party be Yeah, yeah. 224 00:10:43,138 --> 00:10:44,603 A-K-A-K-A Iron Mountain. 225 00:10:44,603 --> 00:10:45,293 Right, right. 226 00:10:45,293 --> 00:10:46,853 Iron Mountain or something like that. 227 00:10:46,853 --> 00:10:47,213 Right. 228 00:10:47,843 --> 00:10:54,023 And, um, the, um, I, I think it's funny that, like, did they, did they 229 00:10:54,023 --> 00:10:56,873 reach out to Iron Mountain, see if they wanted to be branded in the episode? 230 00:10:56,873 --> 00:10:57,443 Probably not. 231 00:10:57,443 --> 00:10:57,743 Yeah. 232 00:10:57,953 --> 00:10:58,373 No. 233 00:10:59,123 --> 00:11:03,053 but it just, it just, it's funny, like anybody in the industry is like, 234 00:11:03,083 --> 00:11:04,973 oh yeah, they mean Iron Mountain. 235 00:11:05,033 --> 00:11:05,363 Right. 236 00:11:05,933 --> 00:11:07,343 Um, but. 237 00:11:07,743 --> 00:11:09,093 There's a couple of things here. 238 00:11:09,123 --> 00:11:13,143 One is first just understanding this concept of reconnaissance, right? 239 00:11:13,713 --> 00:11:19,413 Um, what are the kinds of things, do you think that a, a threat actor, 240 00:11:19,413 --> 00:11:23,133 once they've gained an initial access, what are the kinds of things that 241 00:11:23,133 --> 00:11:24,543 they're going to try to figure out? 242 00:11:25,083 --> 00:11:27,453 Well, they're gonna figure out well for them, right? 243 00:11:27,453 --> 00:11:31,833 They wanna figure out what's the most valuable data in the company, 244 00:11:32,463 --> 00:11:32,793 Right. 245 00:11:32,853 --> 00:11:33,213 right? 246 00:11:33,243 --> 00:11:34,263 That's one thing. 247 00:11:34,593 --> 00:11:36,993 And then where all is that data sitting? 248 00:11:37,763 --> 00:11:38,183 Mm-hmm. 249 00:11:38,388 --> 00:11:43,428 then where are those things that can be used to recover from any sort of attack? 250 00:11:43,878 --> 00:11:46,938 Because remember we talked about with ransomware, right? 251 00:11:46,938 --> 00:11:53,148 It's not just a matter of encrypting your data, deleting your backups. 252 00:11:53,358 --> 00:11:56,238 A lot of these people will also exfiltrate your data, 253 00:11:56,683 --> 00:11:57,033 Right, 254 00:11:57,348 --> 00:11:58,518 For double extortion. 255 00:11:58,723 --> 00:11:59,073 right. 256 00:11:59,118 --> 00:12:05,628 now forced to pay in order to prevent incriminating evidence or bad things 257 00:12:05,628 --> 00:12:06,978 about your company from being published. 258 00:12:08,013 --> 00:12:08,493 Yeah. 259 00:12:08,493 --> 00:12:12,843 And, and, and if I, and I, I agree everything that you said, I will 260 00:12:12,903 --> 00:12:18,153 preface, uh, I will add to your list at the beginning of your list. 261 00:12:18,753 --> 00:12:25,383 Um, basically human based reconnaissance because we see that happening with Angela 262 00:12:25,383 --> 00:12:29,253 and Ollie and I would wager Toti bet. 263 00:12:29,283 --> 00:12:30,093 Well, not wager. 264 00:12:30,303 --> 00:12:35,133 I, I think if we go back to, to the first episode that, um, which oddly 265 00:12:35,133 --> 00:12:37,203 enough is numbered episode zero because. 266 00:12:37,533 --> 00:12:38,073 clarify. 267 00:12:38,073 --> 00:12:38,373 Yeah. 268 00:12:38,553 --> 00:12:41,523 So for people who are watching the show and then trying to map it to 269 00:12:41,523 --> 00:12:45,483 what we're talking about, the show technically starts with Episode Zero. 270 00:12:45,753 --> 00:12:46,023 Yeah. 271 00:12:46,023 --> 00:12:47,608 1.0 and 1.1. 272 00:12:47,673 --> 00:12:52,113 This is episode 1.1, AKA, episode two in, in binary fashion. 273 00:12:52,113 --> 00:12:52,323 Right. 274 00:12:52,323 --> 00:12:53,343 We're starting at zero. 275 00:12:54,003 --> 00:12:56,553 Um, which again, I think it's kind of cool, right? 276 00:12:56,883 --> 00:13:01,053 But, um, and also confusing for certain things, right? 277 00:13:01,773 --> 00:13:07,668 Uh, but basically what we see is clearly in the case of what happened with Elliot. 278 00:13:08,838 --> 00:13:10,968 Which is our main protagonist here. 279 00:13:10,968 --> 00:13:14,928 What happened with Elliot is clearly they did reconnaissance against Elliot. 280 00:13:15,258 --> 00:13:18,528 Clearly, they figured out what he was up to, which, and they 281 00:13:18,528 --> 00:13:21,228 figured out his proclivities. 282 00:13:21,258 --> 00:13:21,648 Right. 283 00:13:21,648 --> 00:13:22,428 They figured out. 284 00:13:22,878 --> 00:13:28,518 I, I think they find, I think they felt that they had found someone 285 00:13:28,818 --> 00:13:33,258 that they could, exploit is a strong word, but they could use, right. 286 00:13:33,333 --> 00:13:35,853 And, and this, and you see this on the previous episode, right? 287 00:13:35,853 --> 00:13:36,213 Where 288 00:13:36,228 --> 00:13:36,648 Yeah. 289 00:13:36,663 --> 00:13:41,043 sitting at the computer terminal in the data center and he's like, 290 00:13:41,103 --> 00:13:43,173 I should go delete this directory. 291 00:13:43,413 --> 00:13:45,843 And it's at the prompt where it's like, yes or no. 292 00:13:45,873 --> 00:13:46,173 And 293 00:13:46,283 --> 00:13:46,573 Yeah, 294 00:13:46,743 --> 00:13:47,343 should do it. 295 00:13:47,343 --> 00:13:48,783 And his finger's hovering over 296 00:13:48,783 --> 00:13:50,113 yeah, yeah. 297 00:13:50,253 --> 00:13:54,213 like, and, and because there was a text file that said, leave me here. 298 00:13:54,693 --> 00:13:55,043 Right. 299 00:13:55,168 --> 00:13:56,788 he's like, it was intended for me. 300 00:13:56,788 --> 00:13:57,748 So I think, like 301 00:13:57,798 --> 00:13:57,858 Yeah. 302 00:13:58,048 --> 00:14:02,098 Curtis, the only way they could have done that is if they had done some sort 303 00:14:02,098 --> 00:14:08,068 of human, uh, read on him to be like, yes, this is the sort of thing that he 304 00:14:08,068 --> 00:14:10,003 is struggling with and let us use him. 305 00:14:10,473 --> 00:14:10,763 Yeah. 306 00:14:10,818 --> 00:14:12,678 Also known as human, right? 307 00:14:12,678 --> 00:14:15,678 Human intelligence and yeah. 308 00:14:15,678 --> 00:14:21,108 So they figured out, and, and, and what we also know about Elliot is he has a 309 00:14:21,168 --> 00:14:28,518 problem, you know, in addition to being antisocial and anti, anti, anti, anti, 310 00:14:28,788 --> 00:14:30,768 uh, he is also got a drug problem, right? 311 00:14:30,768 --> 00:14:31,608 So we're seeing it. 312 00:14:31,608 --> 00:14:33,048 And then, and that's something that. 313 00:14:33,768 --> 00:14:39,528 That again, you know, like, um, I dunno if you've ever heard this, um, the only 314 00:14:39,528 --> 00:14:47,418 two people that actually know you are your hairdresser and your and your CPA, right? 315 00:14:47,793 --> 00:14:48,033 Yep. 316 00:14:48,798 --> 00:14:49,758 Like right. 317 00:14:49,848 --> 00:14:54,078 They know, they know your real, real hair color and your CPA knows where 318 00:14:54,078 --> 00:14:55,308 you're actually spending your money. 319 00:14:55,538 --> 00:14:55,828 Yeah. 320 00:14:56,448 --> 00:14:59,028 And so if someone. 321 00:14:59,463 --> 00:15:01,833 Had done reconnaissance against him. 322 00:15:02,313 --> 00:15:06,153 And, and you know, you think about it, there are the, the, they 323 00:15:06,153 --> 00:15:08,193 targeted him because of his access. 324 00:15:08,408 --> 00:15:08,628 Yep. 325 00:15:08,883 --> 00:15:13,563 He worked at allsafe, which is this, this cybersecurity firm. 326 00:15:13,863 --> 00:15:17,073 So they're like, who can we get that has access into the company? 327 00:15:17,073 --> 00:15:18,123 We're gonna find somebody. 328 00:15:18,183 --> 00:15:23,223 And they probably did a bunch of reconnaissance against all safe, um. 329 00:15:23,268 --> 00:15:24,168 employees and to 330 00:15:24,183 --> 00:15:26,853 And the employees, and they watch 'em and they see what they do 331 00:15:26,853 --> 00:15:30,063 and they see Elliot like going out there buying drugs and stuff. 332 00:15:30,063 --> 00:15:33,903 I mean, if, if they're, this is a big operation and they're gonna 333 00:15:33,903 --> 00:15:39,603 do stuff like that, um, to, to, to do the reconnaissance, to figure 334 00:15:39,603 --> 00:15:42,393 out, um, you know, what's going on. 335 00:15:42,798 --> 00:15:47,328 which was very interesting because you know, Elliot was super careful 336 00:15:47,643 --> 00:15:48,153 Yeah. 337 00:15:48,258 --> 00:15:50,628 a seed right where he hacks. 338 00:15:51,528 --> 00:15:56,088 Terrell, right, who is sort of the person who wants to become 339 00:15:56,088 --> 00:15:59,088 CTO of the of Evil Corps, right? 340 00:15:59,088 --> 00:16:01,638 And he realizes, oh, it's too easy. 341 00:16:01,878 --> 00:16:05,058 And there's a scene where he's literally taking apart his computer. 342 00:16:05,178 --> 00:16:06,828 He's drilling the hard drives, 343 00:16:06,853 --> 00:16:07,143 Yeah. 344 00:16:07,278 --> 00:16:07,428 out 345 00:16:07,458 --> 00:16:07,878 Yeah, 346 00:16:07,968 --> 00:16:11,328 cards and throwing it into the microwave and zapping them. 347 00:16:11,808 --> 00:16:12,138 yeah. 348 00:16:12,168 --> 00:16:14,238 with all being so careful, 349 00:16:15,138 --> 00:16:15,558 Yeah. 350 00:16:15,588 --> 00:16:18,138 Maybe he didn't think about the human intelligence piece. 351 00:16:18,888 --> 00:16:19,458 Yeah. 352 00:16:19,578 --> 00:16:20,088 Yeah. 353 00:16:20,358 --> 00:16:26,718 Um, and, uh, Tyrell, he is, he is a, he is a twisted little fellow himself. 354 00:16:27,018 --> 00:16:27,498 Right. 355 00:16:27,798 --> 00:16:31,608 Um, but, um, 'cause we have the, in this episode we have the scene 356 00:16:31,608 --> 00:16:35,868 of him paying money to go beat the crap outta some homeless dude. 357 00:16:35,868 --> 00:16:38,778 I, I do not know what that, I mean, clearly that's a, you know, it's a. It's 358 00:16:39,138 --> 00:16:41,988 like that's gonna come into play later. 359 00:16:41,988 --> 00:16:50,028 But, but this is the thing, like, like when you have a company, you have 360 00:16:50,028 --> 00:16:54,318 all sorts of people that work for you that have all sorts of weaknesses. 361 00:16:54,583 --> 00:16:54,803 Yep. 362 00:16:55,398 --> 00:16:59,268 They might be financial weaknesses, they might be drug weaknesses, 363 00:16:59,268 --> 00:17:02,268 they might be people, weaknesses. 364 00:17:02,988 --> 00:17:05,178 And if someone, if some entity. 365 00:17:06,228 --> 00:17:10,398 Wants to take your company down, they're, they're going to go through the trouble of 366 00:17:10,398 --> 00:17:14,808 doing this kind of recon, reconnaissance of figuring out who works at your 367 00:17:14,808 --> 00:17:19,428 company to see who they, who's gonna be dumb enough to take a CD off the street 368 00:17:19,773 --> 00:17:20,103 Yep. 369 00:17:20,178 --> 00:17:21,978 then put it into a network computer. 370 00:17:22,608 --> 00:17:23,298 Um, 371 00:17:23,613 --> 00:17:23,793 Do 372 00:17:23,808 --> 00:17:24,138 yeah. 373 00:17:24,573 --> 00:17:28,113 it drives me bonkers because remember back in the day, people would 374 00:17:28,113 --> 00:17:29,943 just leave, like USB sticks around 375 00:17:30,468 --> 00:17:30,828 Yeah. 376 00:17:30,963 --> 00:17:32,733 would pick it up and put it in their machines, 377 00:17:32,778 --> 00:17:33,438 Yes. 378 00:17:33,603 --> 00:17:35,493 would be like, please do not do this. 379 00:17:35,493 --> 00:17:36,153 That is bad. 380 00:17:36,153 --> 00:17:38,193 And then they had to start locking down all the USBs 381 00:17:38,748 --> 00:17:39,258 Yeah. 382 00:17:39,438 --> 00:17:46,308 Uh, another thing, um, is that, well, you, you can buy, like if you buy USB, 383 00:17:46,818 --> 00:17:51,768 like used thumb drives off of eBay or used hard drives, you will get data 384 00:17:51,768 --> 00:17:54,798 on those, on those drives, right? 385 00:17:55,128 --> 00:17:59,508 Um, and uh, again, I, I know I've told this story before, but I love this story. 386 00:18:00,018 --> 00:18:00,528 I'm gonna go back to. 387 00:18:01,983 --> 00:18:05,613 Several years ago when Symantec bought Veritas. 388 00:18:06,513 --> 00:18:12,663 And, um, it was the first, uh, that, and it had a, uh, Veritas vision was 389 00:18:12,663 --> 00:18:17,253 the name of the, of their conference, which it used to be called Vera Con. 390 00:18:17,883 --> 00:18:21,873 But then when they went to international, apparently Raan and 391 00:18:21,873 --> 00:18:23,793 French sounds like very stupid. 392 00:18:24,223 --> 00:18:24,443 No. 393 00:18:24,783 --> 00:18:28,503 and so they changed it to Veritas Vision and then Seman, and then it was 394 00:18:28,503 --> 00:18:30,243 Semantic Vision and it was the first. 395 00:18:31,878 --> 00:18:35,178 Uh, conference after the Semantic rebranding. 396 00:18:35,478 --> 00:18:37,608 And I, I remember two things. 397 00:18:37,608 --> 00:18:39,948 One is they didn't really do anything with NetBackup. 398 00:18:40,068 --> 00:18:43,548 They did literally, and because I remember blogging, I think you 399 00:18:43,548 --> 00:18:47,268 can find a blog on my website 'cause it's been around a while. 400 00:18:47,928 --> 00:18:50,148 You can find a blog on my website that says that the 401 00:18:50,238 --> 00:18:51,823 Semantic apparently spent a year. 402 00:18:52,533 --> 00:18:53,883 Painting everything yellow and black. 403 00:18:54,993 --> 00:18:56,523 That's, that's what I remember saying. 404 00:18:57,183 --> 00:19:02,313 But then it was the trade show and, um, they passed out a thumb 405 00:19:02,313 --> 00:19:07,023 drive, uh, for everyone to that, you know, it was the conference 406 00:19:07,023 --> 00:19:09,543 materials and the thumb drive that. 407 00:19:10,083 --> 00:19:17,433 At the Semantic Conference had had malware on it and um, and so like, it 408 00:19:17,433 --> 00:19:19,953 was like the next day and they were like, Hey, uh, have you got that? 409 00:19:19,953 --> 00:19:22,713 Some don't, don't put it in anything. 410 00:19:22,713 --> 00:19:25,218 It's a, it's kind a thing, which I mean, I mean that's just like. 411 00:19:26,693 --> 00:19:27,113 Ironic. 412 00:19:27,813 --> 00:19:28,233 Yeah. 413 00:19:28,293 --> 00:19:30,363 Ironic to the max, right? 414 00:19:30,393 --> 00:19:34,383 Um, the fact that a, you know, an antivirus company essentially would 415 00:19:34,383 --> 00:19:37,233 distribute a virus or whatever, whatever it was, I dunno if it 416 00:19:37,233 --> 00:19:38,493 was a virus, but it was malware. 417 00:19:38,928 --> 00:19:39,108 Yeah. 418 00:19:39,963 --> 00:19:41,733 Um, at their own conference. 419 00:19:42,843 --> 00:19:42,903 Yeah. 420 00:19:43,053 --> 00:19:48,033 So, I think the one interesting thing about this episode as well, 421 00:19:48,393 --> 00:19:50,793 right, so we talked about the human intelligence piece, right? 422 00:19:50,883 --> 00:19:51,063 Yeah. 423 00:19:51,093 --> 00:19:52,563 kind of understanding who's where. 424 00:19:53,103 --> 00:19:57,093 The other thing was in the episode they talked about, okay, all of their 425 00:19:57,093 --> 00:19:59,403 data is on their primary data center. 426 00:19:59,498 --> 00:19:59,918 Mm-hmm. 427 00:20:00,063 --> 00:20:02,493 Um, and they're like, yeah, we can go delete it. 428 00:20:02,763 --> 00:20:05,403 But being a financial company, guess what it has? 429 00:20:06,093 --> 00:20:07,653 They have paper records, right? 430 00:20:07,818 --> 00:20:08,168 Right, 431 00:20:08,283 --> 00:20:09,183 records still 432 00:20:09,738 --> 00:20:09,963 right. 433 00:20:10,053 --> 00:20:12,663 is actually what is in Steel Mountain. 434 00:20:13,023 --> 00:20:14,163 Oh, is that what's in steel mount? 435 00:20:14,163 --> 00:20:15,213 Is the paper records? 436 00:20:15,333 --> 00:20:15,603 Okay. 437 00:20:15,603 --> 00:20:16,323 I missed that part. 438 00:20:17,163 --> 00:20:18,963 And by the way, something I learned. 439 00:20:20,298 --> 00:20:22,908 I think I've said this in pre stuff, but something I learned is that if 440 00:20:22,908 --> 00:20:28,848 you see a truck that's branded and it says Iron Mountain, it's not like 441 00:20:28,893 --> 00:20:29,643 you did mention it 442 00:20:29,718 --> 00:20:29,928 Yeah. 443 00:20:29,928 --> 00:20:31,128 Level one stuff, right? 444 00:20:31,158 --> 00:20:33,048 It, it's like, I think it might be a, 445 00:20:33,453 --> 00:20:34,113 Shredding. 446 00:20:34,188 --> 00:20:37,188 only be a tape, a paper destruction, right? 447 00:20:37,218 --> 00:20:38,478 It's definitely not tapes. 448 00:20:38,958 --> 00:20:42,708 Uh, but I do remember many years ago, I don't know if it was Iron Mountain, 449 00:20:43,218 --> 00:20:47,838 but it was a, it was an offsite vaulting company and the offsite vault guy. 450 00:20:48,918 --> 00:20:50,358 He was driving his van. 451 00:20:50,358 --> 00:20:51,588 He was a man in a van, 452 00:20:51,753 --> 00:20:52,113 Yeah. 453 00:20:52,158 --> 00:20:57,618 stopped at Starbucks to get some stuff and he came back out and his van was gone. 454 00:20:58,548 --> 00:21:02,058 Oh no, that's not good. 455 00:21:02,088 --> 00:21:04,218 Yeah, it's like go from A to B. Do 456 00:21:04,278 --> 00:21:04,758 Yeah, 457 00:21:05,028 --> 00:21:05,418 Do not. 458 00:21:05,508 --> 00:21:05,988 yeah, yeah. 459 00:21:06,738 --> 00:21:09,048 Um, so yeah, so, so Go ahead. 460 00:21:09,048 --> 00:21:09,408 Go ahead. 461 00:21:09,513 --> 00:21:09,783 Oh 462 00:21:09,828 --> 00:21:09,948 ahead. 463 00:21:09,993 --> 00:21:11,223 yeah, so Steel Mountain. 464 00:21:11,223 --> 00:21:12,423 So they were like, yeah. 465 00:21:12,423 --> 00:21:14,403 And to find that out, right. 466 00:21:14,403 --> 00:21:18,633 They probably had to look at email records and pos and figure out like, 467 00:21:18,933 --> 00:21:23,523 when are records going out the door to this other place, and who's it 468 00:21:23,523 --> 00:21:25,353 going to and what's their schedule? 469 00:21:25,353 --> 00:21:28,083 And oh, you know what it was, is they 470 00:21:28,248 --> 00:21:29,238 I'll just interrupt there. 471 00:21:29,298 --> 00:21:30,108 Just interrupt there. 472 00:21:30,528 --> 00:21:33,738 And the, the amazing thing about things like pos and things like that 473 00:21:33,768 --> 00:21:37,728 is they're like just PDFs and they're generally stored in plain text. 474 00:21:37,728 --> 00:21:38,503 No one thinks about. 475 00:21:40,023 --> 00:21:42,903 Securing that data from outside access. 476 00:21:43,053 --> 00:21:43,383 Go ahead. 477 00:21:43,578 --> 00:21:47,658 Oh, the other thing is they did also mention in the episode they're like, 478 00:21:48,738 --> 00:21:56,058 where most of the s and p 500 stores their or archives, their data, and 479 00:21:56,058 --> 00:21:57,738 that's what they said, steel Mountain. 480 00:21:57,963 --> 00:21:58,023 Yeah. 481 00:21:58,068 --> 00:21:59,478 guess who one of those is? 482 00:21:59,478 --> 00:22:00,408 Is Evil Corp. 483 00:22:00,843 --> 00:22:01,653 Right, right. 484 00:22:01,743 --> 00:22:01,923 And 485 00:22:01,953 --> 00:22:02,643 It's, yeah. 486 00:22:03,363 --> 00:22:06,813 that's where they're like, it is this one facility that we need to attack. 487 00:22:07,278 --> 00:22:07,668 Yeah. 488 00:22:08,358 --> 00:22:13,258 And, I'm willing to go on a limb and say that there is nowhere where Iron Mountain 489 00:22:13,258 --> 00:22:15,568 has a facility next door to a gas. 490 00:22:15,568 --> 00:22:15,598 Uh. 491 00:22:16,093 --> 00:22:21,253 I was, I was, I was going to say, I was like, what is a likelihood that a company. 492 00:22:22,798 --> 00:22:28,048 That is, that is known for, that would put it like right next to a gas plant. 493 00:22:28,288 --> 00:22:28,708 Yeah. 494 00:22:28,888 --> 00:22:35,548 And you know, my, my previous employer I got sent to, um, I got sent to a facility, 495 00:22:35,548 --> 00:22:41,998 a, a secure tape storage facility for a household name financial organization. 496 00:22:42,238 --> 00:22:48,328 And it's in the middle of a giant field right, 497 00:22:48,363 --> 00:22:48,783 Mm-hmm. 498 00:22:49,108 --> 00:22:50,518 berms around it. 499 00:22:51,028 --> 00:22:51,478 Right. 500 00:22:51,808 --> 00:22:55,408 Um, and to get there with a car, you have to go through 501 00:22:55,408 --> 00:22:57,538 three levels of security, right? 502 00:22:57,538 --> 00:23:04,348 There's this, there's a giant like metal barricade that, that, that, that's down. 503 00:23:04,528 --> 00:23:09,298 You talk through a squawk box that lets you, through that barricade, through 504 00:23:09,298 --> 00:23:13,288 the steel reinforced fence, right? 505 00:23:13,768 --> 00:23:16,438 Then you go through there, then you park. 506 00:23:17,053 --> 00:23:18,493 In a parking lot. 507 00:23:18,553 --> 00:23:22,903 Then you go inside and you talk to the person who then determines, you know, 508 00:23:22,908 --> 00:23:26,683 and then, and then, and then you go through another barric, another of the, 509 00:23:26,743 --> 00:23:31,513 you know, crossing guard barricades to go inside a building where they then go 510 00:23:31,513 --> 00:23:34,753 around with one of those like scanning things to scan your car and they're 511 00:23:34,753 --> 00:23:39,883 putting stuff underneath, like I think, I think Iron Mountain would have something 512 00:23:39,883 --> 00:23:41,533 simple, I guess is what I'm saying. 513 00:23:41,623 --> 00:23:41,893 Yeah. 514 00:23:42,283 --> 00:23:43,543 It's like Fort Knox, right? 515 00:23:43,543 --> 00:23:44,113 You don't like 516 00:23:44,143 --> 00:23:44,443 Yeah. 517 00:23:44,503 --> 00:23:45,493 is in the middle of nowhere. 518 00:23:46,363 --> 00:23:47,263 Yeah, exactly. 519 00:23:47,353 --> 00:23:47,983 Exactly. 520 00:23:48,553 --> 00:23:54,223 Um, so yeah, so we talked about that, that basically they would do this, they 521 00:23:54,223 --> 00:23:57,583 would go through all of this effort to do reconnaissance and what we see, 522 00:23:57,583 --> 00:24:02,713 I think at the very end there is we see the beginning of a more digital. 523 00:24:03,358 --> 00:24:04,678 Method of reconnaissance, right? 524 00:24:04,678 --> 00:24:08,728 So now we've got access to the computer and we're, and they're gonna do, I 525 00:24:08,728 --> 00:24:11,728 think a couple of things there because obviously they have webcam access. 526 00:24:12,328 --> 00:24:15,358 So they're gonna be able to listen in on conversations, they're 527 00:24:15,358 --> 00:24:16,498 gonna be able to hear things. 528 00:24:16,498 --> 00:24:19,408 And this is Angela, who is part of allsafe. 529 00:24:19,558 --> 00:24:22,168 And so, and he's also part of allsafe, right? 530 00:24:22,258 --> 00:24:22,528 Ali 531 00:24:22,668 --> 00:24:26,538 Um, and so they're gonna have conversations that, you know, 532 00:24:26,568 --> 00:24:27,948 it'd be great to listen in on. 533 00:24:28,518 --> 00:24:32,598 And so they're, they're gonna be able to do again, um, you know, human-based 534 00:24:32,598 --> 00:24:35,958 intelligence and they're gonna, they're gonna learn all sorts of stuff. 535 00:24:35,988 --> 00:24:37,398 'cause these, these two people, they're, 536 00:24:38,098 --> 00:24:38,458 Yeah. 537 00:24:38,538 --> 00:24:41,673 they're very connected and they're gonna be in their, what they think is a 538 00:24:41,688 --> 00:24:45,348 very safe place discussing, uh, stuff. 539 00:24:45,468 --> 00:24:49,368 Um, but again, just, just going back to, 540 00:24:51,378 --> 00:24:52,368 you know, proper. 541 00:24:53,593 --> 00:24:54,793 Uh, stuff, right? 542 00:24:54,793 --> 00:24:58,393 You, you don't, you don't do that, right? 543 00:24:58,398 --> 00:25:01,693 You don't, you don't, uh, just take a CD off a guy or a thumb drive off 544 00:25:01,693 --> 00:25:06,103 a guy or a thumb drive that you find on the ground, and, uh, and then, uh, 545 00:25:06,283 --> 00:25:07,663 yeah, and then put it in your system. 546 00:25:07,978 --> 00:25:11,758 also please, when you're at an airport and you see those USB 547 00:25:11,758 --> 00:25:14,908 charging ports at an airport, do 548 00:25:14,958 --> 00:25:15,248 Yeah. 549 00:25:15,478 --> 00:25:16,588 in your phone to those. 550 00:25:17,383 --> 00:25:18,613 Well, I will say. 551 00:25:19,063 --> 00:25:21,643 So I'll, I'll, I'll push back on that a little bit. 552 00:25:21,668 --> 00:25:25,273 I, I, I can't argue with it too much, but what I will say is at least a 553 00:25:25,273 --> 00:25:30,283 decent modern phone will say, Hey, you just plugged into this device. 554 00:25:30,283 --> 00:25:31,693 Do you want to trust it? 555 00:25:31,693 --> 00:25:33,403 And I would say, make sure you say no. 556 00:25:33,803 --> 00:25:34,093 Okay, 557 00:25:34,573 --> 00:25:37,003 I mean, best practices don't do it. 558 00:25:37,843 --> 00:25:37,933 Right. 559 00:25:37,933 --> 00:25:40,783 Actually, best practice would be bring a plug. 560 00:25:41,098 --> 00:25:41,458 Yeah. 561 00:25:41,623 --> 00:25:42,523 Right, right. 562 00:25:42,523 --> 00:25:43,273 But yeah. 563 00:25:43,363 --> 00:25:43,633 Yeah. 564 00:25:43,633 --> 00:25:46,123 That, that's best practice, you know, good, better, best. 565 00:25:46,123 --> 00:25:46,423 Right. 566 00:25:46,873 --> 00:25:47,173 Yeah. 567 00:25:47,278 --> 00:25:50,638 even Department of Homeland Security also recommends not 568 00:25:50,713 --> 00:25:51,133 Yeah. 569 00:25:51,133 --> 00:25:53,113 Again, I can't, I can't disagree with you. 570 00:25:53,113 --> 00:25:56,353 I'm just saying if you're, if you're, if you're desperate, if you're gonna, 571 00:25:56,458 --> 00:25:56,698 yeah, 572 00:25:57,853 --> 00:25:58,873 but again, that's what they want. 573 00:25:58,873 --> 00:25:59,833 They want you to be desperate. 574 00:26:00,163 --> 00:26:04,393 Um, and also whatever you do, don't just trust a random cable. 575 00:26:04,483 --> 00:26:07,693 'cause I did watch a presentation on a cable that looked like 576 00:26:07,693 --> 00:26:09,133 just a regular normal cable. 577 00:26:09,373 --> 00:26:11,983 And it, and it, you know, it took over a phone. 578 00:26:12,463 --> 00:26:12,823 Yeah. 579 00:26:13,153 --> 00:26:14,983 Um, and what was that last thing you said? 580 00:26:15,283 --> 00:26:15,494 What was it? 581 00:26:15,523 --> 00:26:17,113 Oh, also on airplanes? 582 00:26:17,278 --> 00:26:18,778 Oh, yeah, yeah, yeah, yeah. 583 00:26:19,258 --> 00:26:19,618 Airplane. 584 00:26:19,618 --> 00:26:21,358 Yeah, because those are definitely, yeah. 585 00:26:21,403 --> 00:26:21,613 Yeah. 586 00:26:22,408 --> 00:26:22,708 Yeah. 587 00:26:23,248 --> 00:26:29,253 Um, so yeah, so basically, again, best practice is not to trust random guy. 588 00:26:29,713 --> 00:26:29,953 Yeah, 589 00:26:30,113 --> 00:26:30,333 Um, 590 00:26:31,123 --> 00:26:38,983 I think the other thing is also be careful what you post online some of these things, 591 00:26:38,983 --> 00:26:40,843 which maybe should not be out there 592 00:26:42,448 --> 00:26:42,658 yeah. 593 00:26:42,658 --> 00:26:44,878 It's something, it's something that, um. 594 00:26:45,358 --> 00:26:49,438 I think our, our generation you are in My generation aren't, no, actually 595 00:26:49,443 --> 00:26:50,788 aren't, aren't you a millennial? 596 00:26:50,788 --> 00:26:51,358 What are you 597 00:26:51,703 --> 00:26:52,933 I'm technically a millennial. 598 00:26:53,338 --> 00:26:54,838 Uh, you're an elder millennial. 599 00:26:54,868 --> 00:26:56,098 Just like I'm an elder. 600 00:26:56,758 --> 00:26:58,198 I'm an elder Gen Xer. 601 00:26:58,768 --> 00:27:00,268 Um, yeah. 602 00:27:00,388 --> 00:27:04,388 So both of our generations I think, understand that a little bit better 603 00:27:04,388 --> 00:27:06,278 than the current generations. 604 00:27:06,338 --> 00:27:10,898 The two, the two, um, where literally they just, they just, you know, 605 00:27:10,898 --> 00:27:12,338 they post, they, they got up. 606 00:27:12,338 --> 00:27:12,998 I, you know, I, 607 00:27:13,168 --> 00:27:13,458 Yeah. 608 00:27:13,568 --> 00:27:16,118 to the bathroom, here's what I had for breakfast, you know, 609 00:27:16,613 --> 00:27:16,883 Well, I 610 00:27:17,043 --> 00:27:17,583 you know what I mean? 611 00:27:17,783 --> 00:27:21,743 had like posted a video of like, they had joined a company and like were 612 00:27:21,743 --> 00:27:25,373 posting like their security stuff, like just a walkthrough of the building and 613 00:27:25,373 --> 00:27:27,353 the security things and it's like, uh, 614 00:27:27,608 --> 00:27:28,838 Yeah, it's no bueno. 615 00:27:28,988 --> 00:27:29,558 No bueno. 616 00:27:30,158 --> 00:27:37,268 Um, so, um, and again, I'll, I'll use this as an opportunity again that 617 00:27:37,268 --> 00:27:44,318 because the backup system is such a target, it needs to be segregated, right? 618 00:27:44,708 --> 00:27:46,433 It needs to be on a separate network. 619 00:27:46,868 --> 00:27:49,958 It needs to be on a separate authentication and authorization system. 620 00:27:49,958 --> 00:27:54,188 , It's gonna be on a separate Entra domain, formerly known as Active Directory. 621 00:27:54,698 --> 00:28:00,098 And, you know, my, my Prasannal is that you would use like local passwords and a 622 00:28:00,098 --> 00:28:05,499 password manager, um, that you wouldn't use a, a network based, um, you know. 623 00:28:06,608 --> 00:28:12,728 System and, and lots of, and lots of MFA and, you know, um, and, you 624 00:28:12,728 --> 00:28:16,998 know, UB keys and like by, you know, incorporate biometrics if you can. 625 00:28:17,178 --> 00:28:17,568 Right. 626 00:28:18,198 --> 00:28:22,428 Um, and, and just have that as separate as you can and, and, and 627 00:28:22,428 --> 00:28:23,778 it sounds like a pain to do it. 628 00:28:23,778 --> 00:28:27,378 And it is a pain the first time, but then when it's like, it's like, 629 00:28:27,378 --> 00:28:31,518 okay, when I'm doing backups, I just need to be on this other system and. 630 00:28:33,228 --> 00:28:38,508 The pain I went through recently, you know, after being chided from with Mike 631 00:28:38,568 --> 00:28:42,618 when he was on here and he was talking about, you know, don't do your financial, 632 00:28:42,858 --> 00:28:47,118 uh, transactions and anything that really matters from a security perspective. 633 00:28:47,913 --> 00:28:51,393 At the same time as you have other browser tabs open in the same browser. 634 00:28:51,393 --> 00:28:53,433 And, and I, I never really thought about that. 635 00:28:53,433 --> 00:28:57,633 And so I went through the trouble of getting a different browser, right. 636 00:28:57,753 --> 00:29:01,263 Um, and, uh, I had to get a browser that was supported by my 637 00:29:01,263 --> 00:29:04,803 password manager, uh, which I had like two or three to choose from. 638 00:29:05,283 --> 00:29:10,758 And then I also added a. Basically enforcement thing, so that if 639 00:29:10,758 --> 00:29:14,808 I forget that, and trust me, I do all day long, I forget it. 640 00:29:14,808 --> 00:29:15,168 Right. 641 00:29:15,648 --> 00:29:21,768 Um, I go to open up, you know, my, my bank on, uh, my usual browser 642 00:29:21,798 --> 00:29:25,728 and, uh, it, it basically says, you know, site prohibited, right? 643 00:29:25,743 --> 00:29:25,953 Yeah, 644 00:29:26,208 --> 00:29:31,158 Um, so it, it was a pain when I first first started doing it, but you 645 00:29:31,158 --> 00:29:32,393 know, there are ways to do it that. 646 00:29:32,643 --> 00:29:35,763 you don't just wipe your computer every hour 647 00:29:36,258 --> 00:29:39,468 I, I do not, I do not wipe my computer every hour. 648 00:29:39,828 --> 00:29:45,048 Um, and um, yeah, and I'll also say that, you know, his drilling of 649 00:29:45,048 --> 00:29:47,808 the thing, you know, for what it's worth, the drilling of the thing. 650 00:29:47,808 --> 00:29:50,178 I mean, it's helpful, but it's not, it doesn't, dam 651 00:29:50,208 --> 00:29:51,588 doesn't destroy the hard drive. 652 00:29:52,338 --> 00:29:56,448 Um, I, I think I like the idea of the, of the microwaving of the chips. 653 00:29:56,448 --> 00:29:59,088 I think that's probably an effective way of getting, you know, because 654 00:29:59,088 --> 00:30:01,038 that's the things that modern devices. 655 00:30:01,543 --> 00:30:02,863 Have all these like chips in them. 656 00:30:02,893 --> 00:30:03,523 What were you gonna say? 657 00:30:03,843 --> 00:30:06,813 he didn't have a giant magnet gals. 658 00:30:06,813 --> 00:30:07,833 The hard 659 00:30:08,143 --> 00:30:08,743 The hard drive. 660 00:30:09,103 --> 00:30:10,333 Those are really expensive. 661 00:30:12,463 --> 00:30:13,573 I mean, really expensive. 662 00:30:13,633 --> 00:30:14,023 Yeah. 663 00:30:14,353 --> 00:30:17,653 A, a ba a magnet big enough to dals a modern hard drive is 664 00:30:17,653 --> 00:30:19,063 actually, uh, quite expensive. 665 00:30:19,563 --> 00:30:19,773 See, 666 00:30:19,903 --> 00:30:20,293 Um, 667 00:30:20,763 --> 00:30:23,523 he would've had something around like his doorframe. 668 00:30:26,223 --> 00:30:26,493 So 669 00:30:26,593 --> 00:30:26,984 it would've to be. 670 00:30:27,738 --> 00:30:31,608 Yeah, that would have to be even, even more, uh, you know, uh, powerful. 671 00:30:31,998 --> 00:30:35,748 But, but the, but the thing that a lot of people do forget about are all the chips. 672 00:30:35,928 --> 00:30:38,268 The chips are in the tapes or in the hard drives or in all 673 00:30:38,268 --> 00:30:39,258 stuff, you know, all that stuff. 674 00:30:39,408 --> 00:30:43,248 The sim cards, sim card, I think sim cards is what he was, uh, destroying. 675 00:30:43,863 --> 00:30:44,083 Yep. 676 00:30:44,928 --> 00:30:48,858 Uh, but again, going back to the, the point of this episode, if someone, 677 00:30:48,858 --> 00:30:52,218 if some entity is going to try to take out your company, they're 678 00:30:52,218 --> 00:30:53,628 going to go through the effort. 679 00:30:54,393 --> 00:30:56,823 That, uh, of, of what we're describing. 680 00:30:56,973 --> 00:30:57,303 Right. 681 00:30:58,083 --> 00:30:59,163 Um, so 682 00:30:59,238 --> 00:31:02,808 is it hopeless then to try to protect against it? 683 00:31:03,873 --> 00:31:08,163 well no, well, no hope Hopeless is a hopeless, is a strong term. 684 00:31:08,823 --> 00:31:13,143 I, I would say in some sense, well, it, it's not hopeless in that like 685 00:31:13,143 --> 00:31:14,553 there is no point in doing it. 686 00:31:14,928 --> 00:31:15,318 Yeah. 687 00:31:15,633 --> 00:31:20,073 It is hopeless in that, oh, well I did it, I did all the things that. 688 00:31:21,258 --> 00:31:27,978 I was told to do, and so therefore I'm good that you know, you, you, you, you 689 00:31:28,038 --> 00:31:31,608 need to understand that you are most likely going to be compromised at some 690 00:31:31,608 --> 00:31:36,408 point, and you therefore need to be, uh, prepared to be able to, to deal with it. 691 00:31:36,903 --> 00:31:45,273 is it that or is it also you should estimate the risk look at your risk 692 00:31:45,273 --> 00:31:47,883 profile for these different activities? 693 00:31:48,048 --> 00:31:48,528 Yeah. 694 00:31:48,558 --> 00:31:50,988 Well, well that's kind of what I mean is like, you know, you, you 695 00:31:50,988 --> 00:31:54,558 need to prepare, you need to do what you can to limit the blast radius. 696 00:31:54,558 --> 00:31:59,238 Do what you can to limit, um, exfiltration and to detect of 697 00:31:59,358 --> 00:32:01,128 exfiltration when it's happening. 698 00:32:01,518 --> 00:32:01,818 Yeah. 699 00:32:02,988 --> 00:32:03,708 and, uh, yeah. 700 00:32:03,738 --> 00:32:05,413 way to understand how all this works, 701 00:32:06,513 --> 00:32:06,993 What's that? 702 00:32:07,433 --> 00:32:08,893 do tabletop exercises. 703 00:32:09,183 --> 00:32:11,193 Yes, tabletop exercises here. 704 00:32:11,193 --> 00:32:14,733 I thought you were gonna, uh, say buy a copy of my upcoming book, but 705 00:32:15,233 --> 00:32:15,773 Oh, that too. 706 00:32:17,763 --> 00:32:20,823 yeah, so, uh, all right, I think we're good. 707 00:32:20,853 --> 00:32:25,863 Um, uh, go watch episode three and, um, and we'll be ready to talk about that 708 00:32:25,998 --> 00:32:28,188 Or episode point or 709 00:32:28,293 --> 00:32:29,523 1.2. It's so, 710 00:32:29,538 --> 00:32:29,838 Yeah. 711 00:32:29,843 --> 00:32:44,538 1.0. Yep. 712 00:32:45,093 --> 00:32:45,423 Yeah. 713 00:32:45,483 --> 00:32:46,263 I live on the second. 714 00:32:46,328 --> 00:32:46,618 Yeah, 715 00:32:46,658 --> 00:32:47,178 that example. 716 00:32:47,208 --> 00:32:47,498 yeah. 717 00:32:49,413 --> 00:32:49,863 Yeah. 718 00:32:49,983 --> 00:32:53,373 It's very disconcerting if you're used to the, it's the 719 00:32:53,373 --> 00:32:55,983 first floor, so it's floor one. 720 00:32:56,013 --> 00:32:58,263 I, I, I, I don't get that. 721 00:33:00,828 --> 00:33:03,438 You know, European 722 00:33:03,603 --> 00:33:04,083 note, 723 00:33:06,888 --> 00:33:07,338 All right. 724 00:33:07,413 --> 00:33:07,473 the 725 00:33:07,608 --> 00:33:07,908 Like, 726 00:33:08,283 --> 00:33:08,433 and 727 00:33:08,508 --> 00:33:08,988 yeah. 728 00:33:09,093 --> 00:33:09,723 podcast episode. 729 00:33:09,738 --> 00:33:10,518 Yeah. 730 00:33:10,788 --> 00:33:12,048 Uh, thanks for helping me out. 731 00:33:12,048 --> 00:33:12,498 Prasanna. 732 00:33:12,843 --> 00:33:13,683 No, this was fun. 733 00:33:13,743 --> 00:33:18,243 I, I do enjoy rewatching the show 'cause I haven't seen it since it came out. 734 00:33:18,243 --> 00:33:18,663 So, 735 00:33:19,233 --> 00:33:19,523 Yeah. 736 00:33:19,943 --> 00:33:20,163 Uh, 737 00:33:20,253 --> 00:33:20,403 back 738 00:33:20,448 --> 00:33:24,318 well it's, it's either that or K-Pop demon hunters. 739 00:33:25,623 --> 00:33:27,183 So my niece wanted me to watch that. 740 00:33:27,183 --> 00:33:30,033 I have not watched it yet, but it's on the list. 741 00:33:30,198 --> 00:33:33,588 Li Lily, my granddaughter has watched it and she told me all about it 742 00:33:33,588 --> 00:33:35,958 and I'm like, okay, well, I'm good. 743 00:33:36,138 --> 00:33:36,708 I think I'm good. 744 00:33:37,608 --> 00:33:42,048 Anyway, um, anyway, thanks for listening folks, and uh, you 745 00:33:42,048 --> 00:33:43,338 know, you're, why we do this. 746 00:33:43,428 --> 00:33:44,358 That is a wrap 747 00:33:47,318 --> 00:33:51,998 . The backup wrap up is written, recorded, and produced by me w Curtis Preston. 748 00:33:52,568 --> 00:33:57,368 If you need backup or Dr. Consulting content generation or expert witness 749 00:33:57,368 --> 00:33:59,948 work, check out backup central.com. 750 00:34:00,668 --> 00:34:03,788 You can also find links from my O'Reilly Books on the same website. 751 00:34:04,448 --> 00:34:08,438 Remember, this is an independent podcast and any opinions that 752 00:34:08,438 --> 00:34:12,368 you hear are those of the speaker and not necessarily an employer. 753 00:34:13,268 --> 00:34:13,958 Thanks for listening.